Modern electronic devices often employ embedded firmware that may periodically need updated as features are enhanced or device problems corrected. Examples of such devices include consumer products such as MP3 players as well as industrial control devices such as programmable automation controllers. When updating firmware in a device, it is important to verify that the firmware is valid for the device and has been created by the manufacturer (e.g., it is not rogue or counterfeit firmware). Also, the respective firmware should be verified so as not to have been tampered with or corrupted. This is particularly important for industrial control systems, where use of invalid, corrupted or otherwise compromised firmware can result in denial of service to the application or at worst unpredictable or dangerous operation. For instance, an attacker could modify a firmware image such that it would render a device unusable, or could modify a firmware image by injecting malicious code that could cause the device to operate in an unsafe manner.
One method to facilitate secure operations of firmware is to employ public and private keys for cryptography. The distinguishing technique used in public key cryptography is the use of asymmetric key algorithms, where the key used to encrypt a message is not the same as the key used to decrypt the respective message. Each user has a pair of cryptographic keys—a public key and a private key. The private key is kept secret, while the public key may be widely distributed. Messages are encrypted with the recipient's public key and can only be decrypted with the corresponding private key. Digital signatures are a message signed with a sender's private key and can be verified by anyone who has access to the sender's public key.
In relation to industrial control systems, a problem arises when trying to determine how to update firmware on differing classes of devices in a secure manner (e.g., older versus newer devices having differing firmware capabilities). Some devices have been in operation for years and may have no knowledge regarding how to process the above-described encryption techniques including public keys and signatures. For instance, with existing firmware—that which is already released for existing devices may not be signature aware. Thus, a problem exists on how existing modules can be updated with signed, signature-aware firmware in a secure manner. If a trouble-shooting scenario exists where a user needs to revert to older firmware, another problem arises in how a module can be “securely” downgraded to unsigned firmware. Still yet other problems include how can existing unsigned firmware be verified for integrity and how can signature-aware production firmware accept a debug or development build that is unsigned. To date, simple checksum procedures have typically been employed for security but there is a need for a more secure mechanism such as public and private key exchanges. Clearly, there is a need for encryption techniques to be applied to electronic firmware update procedures in industrial control systems yet to date, no methods have been developed to address the problem of backwards compatibility with modules that may not have the underlying software capabilities to process advanced encryption technologies.